EventADL: Open-Box Anomaly Detection and Localization for Cloud Events
EventADL represents the inaugural open-box framework designed for event-based anomaly detection and localization within cloud service systems, filling a void left by current ADL techniques that primarily analyze metric and log data. This framework is inspired by a thorough examination of 520 actual incidents, which highlights how anomalies and their underlying causes emerge from event data. EventADL functions through three stages: offline training, online anomaly detection, and root cause localization. In the training stage, it identifies Event Semantic Patterns (ESPs) that reflect typical interactions among system components, as well as Event Frequency Patterns (EFPs) that denote standard frequencies of recognized ESPs. The online phase is dedicated to identifying anomalies within the event stream.
Key facts
- EventADL is the first open-box event-based ADL framework for cloud systems.
- Framework based on analysis of 520 real-world incidents.
- Three phases: offline training, online anomaly detection, root cause localization.
- Learns Event Semantic Patterns (ESPs) and Event Frequency Patterns (EFPs).
- Addresses gap in ADL methods that ignore event data.
- Focuses on cloud-based service systems.
- Provides insights into anomaly manifestation through events.
- Online phase detects anomalies in event stream.
Entities
—